SC-13 Cryptographic Protection
All changes in this version
Title
Cryptographic Protection
Control
a. Determine the [Assignment: cryptographic uses] ; and
b. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: types of cryptography].
Discussion
Cryptography can be employed to support a variety of security solutions, including the protection of classified information and controlled unclassified information, the provision and implementation of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances but lack the necessary formal access approvals. Cryptography can also be used to support random number and hash generation. Generally applicable cryptographic standards include FIPS-validated cryptography and NSA-approved cryptography. For example, organizations that need to protect classified information may specify the use of NSA-approved cryptography. Organizations that need to provision and implement digital signatures may specify the use of FIPS-validated cryptography. Cryptography is implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Parameters
sc-13_odp.01: cryptographic uses
sc-13_odp.02: types of cryptography
Related controls
ac-17, ac-18, ac-19, ac-2, ac-3, ac-7, au-10, au-9, cm-11, cp-9, ia-13, ia-3, ia-5, ia-7, ma-4, mp-2, mp-4, mp-5, sa-4, sa-8, sa-9, sc-12, sc-20, sc-23, sc-28, sc-40, sc-8, si-3, si-7
STIG rules that implement this control 25
Apple iOS/iPadOS 27 V1R1
- AIOS-27-009400 CAT I All mobile operating system (MOS) cryptography must be configured to be in FIPS 140-3-validated mode.
Apple macOS 15 (Sequoia) V1R8
- APPL-15-000054 CAT I The macOS system must limit SSHD to FIPS-compliant connections.
- APPL-15-000057 CAT I The macOS system must limit SSH to FIPS-compliant connections.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-000054 CAT I The macOS system must limit SSHD to FIPS-compliant connections.
- APPL-26-000057 CAT I The macOS system must limit SSH to FIPS-compliant connections.
Application Security and Development V6R5
- APSC-DV-002010 CAT II The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
- APSC-DV-002020 CAT II The application must utilize FIPS-validated cryptographic modules when signing application components.
- APSC-DV-002030 CAT II The application must utilize FIPS-validated cryptographic modules when generating cryptographic hashes.
- APSC-DV-002040 CAT II The application must utilize FIPS-validated cryptographic modules when protecting unclassified information that requires cryptographic protection.
- APSC-DV-002050 CAT II Applications making SAML assertions must use FIPS-approved random numbers in the generation of SessionIndex in the SAML element AuthnStatement.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-671010 CAT I Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-600030 CAT I Ubuntu 24.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Microsoft Windows 11 V2R11
- WN11-SO-000230 CAT II The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
Microsoft Windows Server 2022 V2R11
- WN22-DC-000140 CAT II Windows Server 2022 must use separate, NSA-approved (Type 1) cryptography to protect the directory data in transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data.
- WN22-SO-000360 CAT II Windows Server 2022 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
Microsoft Windows Server 2025 V1R4
- WN25-DC-000140 CAT II Windows Server 2025 must use separate, NSA-approved (Type 1) cryptography to protect the directory data in transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data.
- WN25-SO-000360 CAT II Windows Server 2025 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-000500 CAT I RHEL 10 must enable FIPS mode.
- RHEL-10-300000 CAT I RHEL 10 must have the "crypto-policies" package installed.
- RHEL-10-300010 CAT I RHEL 10 must implement a FIPS 140-3-compliant systemwide cryptographic policy.
- RHEL-10-300090 CAT I RHEL 10 cryptographic policy must not be overridden.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-215100 CAT I RHEL 9 must have the crypto-policies package installed.
- RHEL-09-215105 CAT I RHEL 9 must implement a FIPS 140-3-compliant systemwide cryptographic policy.
- RHEL-09-671010 CAT I RHEL 9 must enable FIPS mode.
- RHEL-09-672020 CAT I RHEL 9 cryptographic policy must not be overridden.